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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the application: 
Listing of Claims: 

1. (Currently Amended) A method performed by one or more [[a]] server devices , the 
method comprising: 

collecting, by one or more processors a processor of the one or more server devices , 
information associated with a group of users visiting a web site that includes an advertising link, 
where the group of users visiting the web site includes a first set of non-malicious users and a 
different second set of malicious users ; 

identifying, by one or more processors of the processor one or more server devices , 
the set of non-malicious users visiting the web site from the group of users visiting the web site 
based on the collected information; 

identifying, by one or more processors of the one or more server devices, a first 
proportion of a number of non-malicious users visiting the web site to a total number of users 
visiting the web site; and 

determining, by one or more processors of the processor one or more server devices , 
an occurrence of spamming on the web site , where based at least in part on a behavior of the 
determining includes: 

identifying a second proportion of a number of clicks on the advertising link 
by identified non-malicious users to a total number of clicks on the advertising link by the group of 
users, and 

comparing the identified first proportion to the identified second proportion . 

2. (Previously Presented) The method of claim 1 where the collecting information 
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tracking activities of the group of users visiting the web site. 

(Previously Presented) The method of claim 2 where the tracking activities includes: 
determining whether the users in the group of users load images. 

(Previously Presented) The method of claim 2 where the tracking activities includes: 
determining whether the users in the group of users have javascript turned on. 

(Previously Presented) The method of claim 2 where the tracking activities includes: 
determining a type of browser used by the users in the group of users. 

(Previously Presented) The method of claim 2 where the tracking activities includes: 
determining an interval at which each of the users in the group of users visits the web 

(Previously Presented) The method of claim 2 where the web site is a search engine, 

where the tracking activities includes: 

determining a type of items for which searches are performed by the users in 

'users. 

(Previously Presented) The method of claim 2 where the tracking activities includes: 

tracking activities of users in the group of users visiting another web site. 
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9. (Previously Presented) The method of claim 2 where each of the users in the group of 
users is associated with a cookie identifier, and 

where the tracking includes: 

using the cookie identifiers to track the activities of the users in the group of 

users. 

10. (Previously Presented) The method of claim 1 where each of the users in the group of 
users is associated with a cookie identifier, and 

where the identifying non-malicious users includes: 

identifying non-malicious users based at least in part on an age of the cookie 
identifiers associated with the users in the group of users. 

1 1 . (Previously Presented) The method of claim 1 where each of the users in the group of 
users is associated with a network address, and 

where the identifying non-malicious users includes: 

identifying the non-malicious users based at least in part on the network 
addresses associated with the users in the group of users. 

12. (Canceled) 

13. (Canceled) 



14. (Canceled) 
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15. (Previously Presented) The method of claim 1 where the determining includes: 

determining an occurrence of spamming of at least one advertisement on the web site, 

and 

where the method further comprises: 

providing a refund in response to determining that the at least one 
advertisement has been spammed. 



16. (Currently Amended) A system comprising: 

means for providing a web site that includes at least one advertisement to a plurality 
of visitors, where the plurality of visitors includes a plurality of malicious visitors and a plurality of 
non-malicious visitors, 

means for identifying malicious visitors to the web site; 

means for identifying non-malicious visitors to the [[a]] web site; 

means for determining a percentage of the non-malicious visitors out of the plurality 
of visitors to the website; 

means for tracking at least one activity of the identified non-malicious visitors; and 

means for determining an occurrence of click spamming on the web site based at least 

in part on the tracked at least one activity of the identified non-malicious visitors , where the means 

for determining the occurrence of click spamming include: 

means for comparing the percentage of non-malicious users selecting the at 

least one advertisement during the time period to the percentage of non-malicious users visiting the 

web site during the time period, and 

means for determining that the at least one advertisement has been spammed 
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when the percentage of non-malicious users selecting the at least one advertisement during the time 

period is significantly lower than the percentage of non-malicious users visiting the web site during 

the time period . 

17. (Previously Presented) A computer-readable memory device containing instructions 
for controlling at least one processor to perform a method for detecting click spamming of an 
advertisement on a server, the method comprising: 

determining a number of non-malicious users accessing the server; 

determining a percentage of the non-malicious users clicking the advertisement when 
the advertisement is provided to the non-malicious users; and 

determining whether the advertisement has been click spammed based at least in part 
on the determined percentage. 

18. (Previously Presented) A server comprising: 

a memory to store at least one advertisement; and 

a processor to: 

cause the at least one advertisement to be presented, 

determine a number of non-malicious users accessing the server, 

determine a percentage of the non-malicious users clicking the at least one 

advertisement, and 

determine whether the at least one advertisement has been click spammed 
based at least in part on the determined percentage. 



19. (Currently Amended) A method performed by one or more [[a]] server devices , the 
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method comprising: 

identifying, by one or more processors a processor of the one or more server devices , 
a group of non-malicious users visiting a web site; 

determining, by one or more processors of the processor one or more server devices , a 
click rate of an item associated with the web site for the group of non-malicious users; and 

determining, by one or more processors of the processor one or more server devices , 
whether the item has been click spammed based at least in part on the determined click rate for the 
non-malicious users. 

20. (Previously Presented) The method of claim 19 further comprising: 
determining a total number of users visiting the web site, and 

where the determining whether the item has been click spammed includes: 

comparing the determined click rate for the non-malicious users to a click rate 

for the total number of users visiting the web site, and 

determining that the item has been click spammed when the click rate for the 

total number of users exceeds the determined click rate for the non-malicious users. 

21. (Previously Presented) The method of claim 19 where the identifying includes: 
tracking an activity of users visiting the web site, and 

identifying the group of non-malicious users based at least in part on the tracked 

activity. 

22. (Previously Presented) The method of claim 21 where the tracking includes 

determining, for each user, at least one of whether the user loads images, an age of a cookie 
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associated with each user, whether the user has javascript turned on, a type of browser used by the 

user, or an interval at which the user visits the web site. 

23. (Original) The method of claim 19 further comprising: 

taking remedial measures in response to determining that the item has been click 

spammed. 

24. (Previously Presented) The method of claim 19 where the determining a click rate of 
the item for the group of non-malicious users includes: 

estimating a percentage of non-malicious users visiting the web site, and 
setting a percentage of clicks of the item from non-malicious users to approximately 
equal the estimated percentage. 

25. (Previously Presented) The method of claim 24 where the determining whether the 
item has been click spammed includes: 

determining whether an actual click rate of the item for the group of non-malicious 
users differs from the set percentage of clicks of the item. 

26. (Previously Presented) The method of claim 19 where the determining a click rate of 
the item includes: 

determining different click rates of the item for the group of non-malicious users, the 
different click rates corresponding to different time periods. 

27. (Previously Presented) The method of claim 26 where the different time periods 
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include different times of a day or week. 



28. (Previously Presented) The method of claim 26 where the different time periods 
include different months of a year. 



29. (Currently Amended) A computer-readable memory device containing instructions 

for controlling at least one processor to perform a method for detecting a spamming of an 

advertisement displayed by a server, the method comprising: 

identifying non-malicious visitors to the serve r, where identifying the non-malicious 

visitors includes identifying that the non-malicious visitors are not spam programs ; 

determining a click rate of the advertisement for the non-malicious visitors; and 
determining whether the advertisement has been spammed based at least in part on 

the determined click rate for the non-malicious visitors. 



30. (Previously Presented) A server comprising: 

a memory to store at least one item; and 

a processor to: 

cause the at least one item to be displayed, 

identify a number of non-malicious users accessing the server, 

compare the number of non-malicious users to a total number of users to 

obtain a percentage, 

set a click rate of the at least one item based at least in part on the percentage, 

and 

determine whether the at least one item has been spammed based at least in 
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part on the click rate. 



3 1 . (Currently Amended) A method performed by one or more processors of one or more 
[[a]] server devices , the method comprising: 

tracking, by one or more processors a processor of the one or more server devices , 
activities of users visiting a web site that includes one or more advertising links , the tracking 
including determining, for each user, at least one ofj. 

whether the user loads images, 
an age of a cookie associated with each user, 
whether the user has javascript turned on, 
a type of browser used by the user, or 
an interval at which the user visits the web site; [[and]] 
identifying, by the processor, non-malicious users from among the users visiting the 
web site based at least in part on the tracked activities; 

determining whether the advertising link has been spammed, where the determining 

includes: 

comparing an actual click rate of the advertising link by non-malicious users 
to an estimated click rate of the advertising link by non-malicious users, where the estimated click 
rate is based on historical data . 



32. (Previously Presented) The system of claim 16 where the means for identifying non- 
malicious visitors includes at least one of: 

means for determining whether visitors to the web site load images, 

means for determining whether the visitors to the web site have javascript turned on, 
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means for determining a type of browser used by the visitors to the web site, 

means for determining an interval at which the visitors to the web site visit the web 

site, or 

means for determining a type of items for which searches are performed by the 
visitors to the web site. 

33. (Canceled) 

34. (Previously Presented) The computer-readable memory device of claim 17 where the 
determining whether the advertisement has been click spammed based at least in part on the 
determined percentage includes: 

comparing the determined percentage of the non-malicious users clicking the 
advertisement to a percentage of non-malicious users clicking the advertisement from a different 
time period. 

35. (Previously Presented) The computer-readable memory device of claim 17 where the 
determining whether the advertisement has been click spammed includes: 

estimating a percentage of non-malicious users clicking the advertisement to be 
approximately a percentage of non-malicious users accessing the server, and 

determining that the advertisement has been clicked spammed when the determined 
percentage of non-malicious users clicking the advertisement is lower than the estimated percentage 
of non-malicious users clicking the advertisement. 



36. (Previously Presented) The server of claim 18 where, when determining whether the 
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at least one advertisement has been click spammed, the processor is to: 

compare the determined percentage of the non-malicious users clicking the at least 

one advertisement to a percentage of non-malicious users clicking the at least one advertisement 

from a different time period. 

37. (Previously Presented) The server of claim 18 where, when determining whether the 
at least one advertisement has been click spammed, the processor is to: 

estimate a percentage of non-malicious users clicking the at least one advertisement 
to be approximately a percentage of non-malicious users visiting the server, and 

determining that the at least one advertisement has been clicked spammed when the 
determined percentage of non-malicious users clicking the at least one advertisement is lower than 
the estimated percentage of non-malicious users clicking the at least one advertisement. 

38. (Previously Presented) The computer-readable memory device of claim 29 where the 
method further comprises: 

determining a total number of visitors to the server, and 

where the determining whether the advertisement has been spammed includes: 

comparing the determined click rate for the non-malicious visitors to a click 
rate for the total number of visitors to the web site, and 

determining that the advertisement has been spammed when the click rate for 
the total number of visitors exceeds the determined click rate for the non-malicious visitors. 

39. (Previously Presented) The computer-readable memory device 29 where the 

identifying non-malicious visitors to the server includes: 
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tracking a factor associated with visitors to the server, the factor including at least one 
of whether the visitors load images, ages of cookies associated with the visitors, whether the visitors 
have javascript turned on, types of browsers used by the visitors, or intervals at which the visitors 
visit the server, and 

using the tracked factor to identify the non-malicious visitors to the server. 

40. (Previously Presented) The server of claim 30 where, when identifying a number of 
non-malicious users accessing the server, the processor is to: 

track a factor associated with users accessing the server, the factor including at least 
one of whether the users load images, ages of cookies associated with the users, whether the users 
have javascript turned on, types of browsers used by the users, or intervals at which the users access 
the server, and 

use the factor to identify the number of non-malicious users accessing the server. 

41 . (Previously Presented) The server of claim 30 where the at least one item includes an 
advertisement. 

42. (Currently Amended) The method of claim 31 further comprising: 

determining a quantity of the identified non-malicious users that clicks the [[an]] 
advertisement link associated with the web site ; and 

determining whether the advertisement has been spammed based on the determined 
quantity of the identified non-malicious users that clicks the advertisement. 

43. (Previously Presented) The method of claim 3 1 further comprising: 
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determining that spamming occurs on the web site based on a behavior of the non- 
malicious users visiting the web site. 

44. (New) The method of claim 1 where the determining the occurrence of spamming on 
the web site further includes: 

determining, based on the comparing, that the identified first proportion is greater 
than the identified second proportion. 

45. (New) The method of claim 1 where the determining that the occurrence of 
spamming on the web site further includes: 

determining, based on the comparing, that the identified first proportion is greater 
than the identified second proportion plus a predefined threshold. 

46. (New) The system of claim 16 where the means for identifying malicious visitors 
comprise means for identifying spam programs. 
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